Skip to main content

Scan a repository

Start a scan with a credit limit, watch it run and read the findings

Scans are in beta and open workspace by workspace; until yours is open, the routes answer 404 scans_off. You need purchased or granted credits (the free allowance does not fund scans) and a key with scans:read and scans:write from an owner or admin.

1. Pick a limit​

max_credits is both the deduction and the stop point. Scans bill tokens: $3 / 1M input tokens, $0.30 / 1M cached input tokens, $15 / 1M output tokens. Measured runs came to about 8,463 credits (about $8.46 at list) for a 100-file repository and about 57,720 credits (about $57.72 at list) for 1,000 files. Set the limit above what you expect; whatever the scan does not use is refunded.

2. Start the scan​

curl -s https://app.makesmores.com/api/v1/scans \
  -H "Authorization: Bearer $SMORE_API_KEY" \
  -H "Content-Type: application/json" \
  -d @- <<JSON | tee scan.json
{
  "repo_url": "https://github.com/your-org/your-repo",
  "ref": "main",
  "idempotency_key": "guide-scan-$(date +%s)",
  "max_credits": 20000
}
JSON

For a private repository, add github_token: a fine-grained token with read-only contents, used once to clone and then deleted. Keep the idempotency_key if you might retry: the same key and body return the same scan instead of starting a second one.

3. Watch it​

curl -s "https://app.makesmores.com/api/v1/scans/$(jq -r .id scan.json)" \
  -H "Authorization: Bearer $SMORE_API_KEY" | jq '{status, stage, progress, credits_used, heartbeat_at}'

The stages run in order: cloning, dependency_review, advisory_check, source_review, counter_review and rendering. Poll at poll_after_s; reading is free. credits_used is an estimate from the tokens so far until the scan ends. A scan whose heartbeat stops for 15 minutes fails with heartbeat_lost and is refunded in full.

4. Read the findings​

When status is complete (or partial, when some batches could not finish), the scan carries a summary with the counts and up to five top findings, and report_ready turns true:

curl -s "https://app.makesmores.com/api/v1/scans/$(jq -r .id scan.json)" \
  -H "Authorization: Bearer $SMORE_API_KEY" | jq '.summary | {code_supported, unresolved, dismissed, checked, findings}'

Download the full report:

curl -s -o report.html "https://app.makesmores.com/api/v1/scans/$(jq -r .id scan.json)/report" \
  -H "Authorization: Bearer $SMORE_API_KEY"

Findings come in three groups:

  • Code-supported: the second pass found the risky code in your repository. Each has its severity, file, lines, the quoted code, what it means and what to do.
  • Unresolved: worth a look, but the evidence was not conclusive.
  • Dismissed: the second pass ruled them out.

The report also lists dependency findings with reachability, matches against fresh CVEs, coverage, and the tokens and credits used. To give someone the report without the file, an owner or admin can make a share link from the scan in the console. Nobody needs to sign in to read it. A link lasts 30 days, or 1 to 90 days if you pick a length, and you can revoke it at any time.

5. Cancel if you need to​

curl -s -X POST "https://app.makesmores.com/api/v1/scans/$(jq -r .id scan.json)/cancel" \
  -H "Authorization: Bearer $SMORE_API_KEY"

A queued scan is refunded in full. A running scan stops at its next heartbeat; the tokens it used are billed and the rest is refunded.

Limits​

Repositories up to 1 GB and 5,000 files, on GitHub. A repository over either limit fails with repo_too_large and costs nothing.